I want to know what ports and protocols tezos-node and baker uses so that i can enable only those ports and protocols in my firewall setting to prevent any DDos attack on my server.
9732is the default port for P2P connections, can be overridden with
--net-addr=ADDR:PORTwhen starting the node
8732is the default port for RPC connections, can be overridden with
- All networking uses TCP.
iptables the below rules should suffice for tezos specifically.
Be aware you will need to allow other non tezos network services like DNS,NTP,DHCP depending on your configuration.
# Allow Tezos RPC iptables -A INPUT -p tcp --dport 8732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 8732 -m conntrack --ctstate ESTABLISHED -j ACCEPT # Allow Tezos P2P connections iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT
@xtzbaker is spot on with the ports that the node uses. Preventing DDoS for the baking node is also one of the reasons that the most common setup for baking is to have a private baking node with trusted public nodes.
Basically, we have a single node that the baker and endorser uses and it's configured to be on private mode. Private mode will disallow connections from others and also tell its peers to not broadcast the node's existence to their peers. In order to truly keep our private node private, the private node's peers must be trusted to not reveal your private node's ip. This means your private node needs to set explicit peers to trusted nodes(as opposed to just let the node choose any available peers on the network).
What does it mean for a node to be trustworthy? Well, it varies from person to person depending on your accepted level of risk. But if you want to truly trust a node, the only way is to own them yourself. That said, many bakers accept the foundation public nodes to be trustworthy enough.
You could also add an extra layer of security by having your node's internet connection go through a DDoS protected VPN, like OctoVPN https://octovpn.com